Fix unauthorized upgrade and version information disclosure

Add permission check to `tools/upgrade`.

Unauthorized upgrade process was basically possible if upgrade files would have been previously downloaded. Permission check also prevents version information disclosure.

There is no actual permission key to check upgrade permissions, so `backup` is checked instead. Maybe there should be one?